Oracle Supply Chain: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 8.2
  CVE-2023-37536

  HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

  An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

  HCL Software BigFix Platform xerces-c xerces-c Debian Ubuntu
  Oct 11, 2023
• High 7.5
  CVE-2022-34169 Public exploit EPSS 82%

  Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets

  The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are re…

  Apache Software Foundation Apache Xalan-J openjdk-8 openjdk-lts Debian Ubuntu Alpine Maven
  Jul 19, 2022
• High 7.5
  CVE-2023-24998 Public exploit EPSS 49%

  Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

  Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…

  Apache Software Foundation Apache Tomcat Apache Commons FileUpload tomcat9 Debian Ubuntu Maven
  Feb 20, 2023
• High 7.5
  CVE-2023-46589

  Apache Tomcat: HTTP request smuggling via malformed trailer headers

  Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Nov 28, 2023

Revision history

1. 2024-07-16 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2024 - Appendix Oracle Supply Chain vom 2024-07-16
  https://www.oracle.com/security-alerts/cpujul2024.html#AppendixSCP